The Redirection for Contact Form 7 plugin for WordPress contains a flaw in its delete_associated_files function that does not properly validate file paths. This flaw allows an attacker who can reach the plugin’s interface to delete any file on the server. Removal of critical files such as wp-config.php can provide an attacker with the ability to gain remote code execution or compromise the site’s integrity and availability. The weakness is identified as an arbitrary file deletion vulnerability (CWE-22).

This problem exists in all releases of the Redirection for Contact Form 7 plugin up to version 3.2.4. The affected product is the WordPress plugin Redirection for Contact Form 7 distributed by Themeisle. Users running any of these versions on a WordPress site are at risk.

With a CVSS score of 8.8 the vulnerability is considered high severity, although the EPSS score indicates a very low current exploitation likelihood (<1%). It is not listed in the CISA KEV catalog. The attack can be carried out by any unauthenticated user who can invoke the delete_associated_files routine, making the threat human‑friendly. Once the attacker deletes a file that is subsequently loaded by the server, remote code execution can be achieved without needing further access or credentials. Because the vulnerability does not require any advanced conditions, the risk to affected sites is considerable should an attacker locate a way to trigger the deletion endpoint.